Positioning, Navigation, and Timing (PNT) Governance – Required Improvements

Governance must ensure that sufficient rules, awareness systems, and operational capability exists to prevent most service disruptions, and to respond to the disruptions that do occur

Dana Allen Goward President, Resilient Navigation and Timing Foundation, USA

The motion picture “Gravity” begins with a series of cascading failures. The destruction of one satellite creates orbiting debris. This debris sweeps through space destroying multiple satellites, which makes much more debris and destroys many more satellites. One imagines the process continuing until the entire orbital sphere contains nothing but fragments of fragments.

The film is instructive for government leaders and PNT policy professionals in two ways. First it reminds us that, simply because satellites dwell high above the earth, they are not immune to mishap. Severe space weather, cyberattack, asteroids, and other misfortunes – including cascading showers of debris – could damage or cripple even the most robust constellation. Secondly, it is a dramatic example of progressive failures. It shows how the failure of one component of a system, if not contained, can ripple outward wreaking extensive destruction.

For many nations, GNSS is a single point of failure that can cause cascading failures across society. Because it is highly precise and free for use by anyone with an inexpensive receiver, clever (and economy minded) engineers have incorporated GNSS navigation and timing signals into nearly every facet of modern life. Financial transactions are marked with a GNSS time stamp. IT systems, cell phone networks and many synchronized electrical grids depend upon GNSS time and/or frequency for proper functioning. Agriculture is reputed to be 30% more efficient and productive in many places because of GNSS technology. And, of course, GNSS signals are essential for modern transportation systems and networks. They are even used to synchronize traffic lights on some busy city streets, and in the engine controls of some vehicles and vessels.

GNSS has become an essential, silent, utility, like running water. It is possible, with some discomfort, and reduction in safety and efficiency, for modern societies to do without it for short periods. Extended outages could be disastrous.

Space systems, by their very nature, transmit very faint signals that are easy to disrupt. This is a vulnerability that many militaries are able to exploit by jamming GNSS over wide areas. North Korea has repeatedly done this to South Korea. Recognizing that signals from space are so faint and easy to disrupt, Russian military doctrine assumes that space systems will not be available to its forces in combat. The US military is also very concerned, and regularly holds exercises such as “A Day Without Space.”

Until now, though, most non-military GNSS disruptions have been fairly localized and confined to areas of several square kilometers or less. Some of these disruptions have been accidental. For example, novice US Navy technicians have accidently jammed significant portions of the San Diego and Norfolk metropolitan areas at various times. The great majority, of such incidents, though, have been as a result of individuals with “Personal Protection Devices” or “PPDs.” Illegal in most countries, but inexpensive and easy to obtain from online sellers, these devices can operate from a small battery or a vehicle’s lighter/ power outlet. Many are able to completely disrupt GNSS reception within tens or hundreds of meters. PPDs are becoming increasingly popular among individuals who don’t wish to be tracked by their spouses, employer, or governments.

Though few formal monitoring programs exist, authorities in the UK, US and elsewhere report that PPD usage is on the rise. Such devices have been responsible for interfering with airport systems, cellular communications, and stock exchanges. In fact, few systems that use GNSS have been spared at least minor disruptions. Many GNSS professionals are familiar with the incidents at the Newark International Airport in the United States that disrupted aircraft landing systems. Less well known is that the airport detects approximately 5 jamming devices a day passing by on a highway it abuts.

More recently, French authorities monitored over 2,100 GNSS jamming incidents during a six month period on the A1 highway that runs through Charles de Gaulle International Airport. More insidious, and potentially more problematic and dangerous, spoofing has also been revealed as a vulnerability for many GNSS users. Spoofers have effectively assumed control of both surface vessels and unmanned aircraft by transmitting signals only slightly stronger than those from GNSS. While advances have been made in receiver and antenna technology to reduce this threat, the nature of GNSS signals and the proliferation of inexpensive receivers means that spoofing will be a potential problem for many years to come.

Governments’ responsibilities

The most important function of government is protection of its citizens. Yet, in spite of PNT’s criticality, few governments recognize it as critical infrastructure, or have even formally acknowledged its importance. Fewer still are organized to ensure PNT services, and by extension, its citizens, are protected.

The United States presented an incredible gift to the world by making GPS available to all. Other GNSS are following suit. Unfortunately, as the only sources of precise, wide area, wireless PNT for many nations, these free gifts have become like the first samples of a highly addictive drug. They have rapidly created a broad dependency upon space that, if it was no longer available, could cause the user extreme distress. Governments have a responsibility to protect their citizens and reduce this, potentially life threatening, dependence.

One of the important ways governments protect their citizens is by providing and preserving “common goods.” Things like defense forces, diplomatic services, etc., that benefit all, but that individuals and small groups are unable, unwilling, or shouldn’t do on their own. With many nations providing, or planning to provide, space-based PNT (GNSS) free of charge and available to all, PNT services have become widely seen as a common good. But nations that do not have adequate PNT governance suffer from “the tragedy of the commons” in this area. Like the world’s other commons – space, the oceans, cyberspace – everyone wants to use PNT, but no one wants to pay for and maintain it.

PNT services, which are necessary for so many different things, and touch people in so many different ways, must be coherently governed, if the public good they provide is to be preserved.

A Governance Model

In order to think systematically about the actions governments should and must take to reverse this situation and ameliorate the threat, it is helpful to first think about how they work. Governments protect their citizens by

(1) preventing adverse incidents when they are able, and when they are not, by

(2) responding to ameliorate damage and restore things to normal. For example, governments take steps to prevent hazardous chemical spills. When spills do occur, they protect citizens by ensuring a rapid response to clean it up.

“Prevention” and “response” efforts can be classified as falling within one of three categories – Rules, Awareness, and Operations.

• Rules – approved and preferred behaviors articulated in laws, regulations, best practices, etc.

• Awareness – being able to sense the environment, determine if the rules are being followed, and discover information that would inform action (examples: Being aware of adverse trends to be reversed to prevent an adverse event, or, in a response, information needed to aid restore normalcy). This includes collecting, storing and analyzing data so that it can become information and knowledge.

• Operations – interacting with the real world to:

– Encourage or compel adherence to the rules

– Shape the environment to prevent adverse incidents

– Restore the environment to the desired state. Using this model, we can discover and organize the kinds of things governments should do to protect its citizens from adverse PNT-related events.

Prevention and response

Prevention

Video of helicopters braving storm winds to rescue hapless victims is very dramatic and plays well in the media. Yet, it is also evidence of a failure to prevent the incident in the first place.

Preventing bad things from happening, in addition to eliminating human pain and suffering, is almost always more economical than responding to and recovering from an adverse event. For the price of one ship and the rescue of its crew by helicopter, for example, a whole fleet of vessels could be inspected to ensure their hulls are strong, and their bilge pumps in working order.

Rational governments put the majority of their efforts into preventing bad things from happening so as to avoid societal damage and costly response operations.

For our purposes, the “bad thing” to be prevented is disruption of PNT services. The following list provides a starting point for the kind of Rules, Awareness, and Operations a government should have in place as part of its prevention efforts:

Prevention rules

(Laws, regulations, best practices, etc.) – These should:

• Ban or strictly limit the manufacture, import, export, sale, possession, and use of jamming and spoofing devices. To be effective, such rules must provide for penalties sufficient to deter the proscribed actions. Penalties vary widely across the globe. In Australia, use of a jammer is punishable by time in jail. In the United States, it is a civil (as opposed to criminal) offense punishable by a monetary fine. Some nations have no laws or regulations on the topic whatsoever.

• Require owners and operators of critical infrastructure and critical applications that rely upon GNSS signals to have and use a second navigation and/ or timing source that has different characteristics and failure modes. Requiring systems with different failure modes is essential for resilience so that one disruption event does not impact both systems. Using GLONASS or Galileo, for example, to complement GPS does not provide much added resilience as all are faint, space-based signals that operate in the same frequency band. Also, such requirements should be carefully structured so as to avoid “economical, malicious compliance” that meets the letter of the mandate, but does not increase resilience. For example, governments may wish to include a requirement for the non- GNSS system to be able to sustain operations for 60 or more days in the absence of GNSS services.

• Require major commercial consumers of GNSS services to actively participate in jamming and spoofing prevention and response efforts. This could include mandatory reporting of disruption incidents, required participation in detection networks, etc.

• Establish industry standards for GNSS receivers used for critical systems that reduce their susceptibility to jamming and spoofing. Many receivers, for reasons of economy, are designed to minimal standards and are subject to regular and predictable disruption from known and legal sources. For example, some receivers malfunction when authorities activate known, authorized, but non-routine, GNSS functions. This is because it would have been more expensive to design and build the receiver otherwise.

• Establish spectrum management standards that protect GNSS frequencies.

Prevention awareness

(The ability to detect, develop data and records, and analyze trends) – This should include the ability to:

• Detect illegal manufacture import, export and sale of jamming and spoofing devices.

• Detect use of jamming and spoofing devices. While scattered, localized capability exists in many nations now, it is ad hoc, there are few organized networks, and few records are kept. Given the broad use of GNSS across societies, greatly broadening, networking and systematizing jamming and spoofing detection should be relatively easy and inexpensive. For example, if every cell tower had the capability to detect potential jamming or spoofing, an automated reporting network could easily be created. The cost of establishing such a system would be miniscule compared to the value of just the cellular infrastructure it protected.

• Understand the use, performance and reliability of all PNT sources. The goal of each nation should be to have a “healthy navigation and timing eco-system” that includes multiple sources with different failure modes that simultaneously support each other and fill the needs of all users. A complete understanding of each PNT sources is needed to ensure the resilience of the nation’s overall PNT capability and resilience. These sources include GNSS, VOR/DME, TACAN, Loran/eLoran, local positioning systems, inertial systems, clocks of all types, dead reckoning, compasses, etc.

• Analyze trends and to inform improvements in rules, awareness and operations.

Prevention operations

(The use of information gained through Awareness, to encourage or compel compliance with Rules) – This requires sufficient enforcement and administrative capability to:

• Terminate illegal manufacture, import, export, sale, and possession of jamming and spoofing devices.

• Ensure PNT consumers, especially those with critical infrastructure and applications, comply with resilience Rules (standards, regulations, etc.)

• Ensure those who violate the Rules are appropriately processed and sanctioned.

• Ensure compliance with spectrum and equipment standards.

• Analyze prevention failures and modify Rules, Awareness and Operations to help avoid similar adverse events in the future.

Response

Even with the best prevention efforts, bad things will, inevitably, happen. When they do, governments must ensure sufficient capability and be ready to respond, recover and restore critical systems. Wise and efficient governments focus their response efforts on small, low level infractions as a way of creating an orderly environment and forestalling more serious offenses. Just as New York City authorities aggressively enforce requirements to replace cracked windows as a way of deterring neighborhood crime, governments should vigorously pursue individuals using “Personal Protection Devices” as a way of averting larger incidents and protecting critical infrastructure.

Response rules

These should dictate, who has the authority to act, where capability should reside, and how responses should be coordinated and conducted. – They should:

• Make manufacture, sale, possession and use of jamming and spoofing devices an offense at all levels of government. The great majority of law enforcement resources for many nations exist at the state and local, vice federal, levels of government. Being able to leverage local Awareness and Operations capabilities depends upon local officials having the authority to participate in enforcement. Having this authority could be of great interest to local law enforcement. Detecting the presence of an active jammer during a routine traffic stop, for example, could be an indication of other illicit activity and aid community policing (pocket-sized jammer detectors are commercially available).

• Provide the authority for information sharing, joint operations and coordination among all private, commercial, and government organizations.

• Designate an organization to lead development of standard operating procedures, best practices, recommended equipment, etc. for responses.

• Outline priorities and responsibilities for recovery operations.

Response awareness

The ability to understand the extent of an incident and the condition of PNT services nationwide, to locate disruption sources in real time, and to know the location, status and activities of enforcement resources. This capability should include:

• Rapid location and identification of disruption sources, including those on moving platforms. Most disruption sources are mobile. Static detection networks need to be able to track their movement in real time and communicate that to enforcement personnel. Enforcement personnel must also have mobile detection capability in order to precisely locate and identify the source of a disruption. A nightmare scenario for many authorities is a jamming device suspended from a weather balloon set adrift in light winds over a densely populated area. Not only would it wreak havoc on numerous systems, it would be very difficult to locate and disable. Location of mobile jammers on the land, sea, and in the air should be part of the awareness capability suite.

• The ability to understand the state of PNT services nation-wide. As a national, critical infrastructure utility, wide area PNT services should be monitored for outages and to support rapid response and recovery. Having this “big picture” also helps authorities triage between localized issues and larger, perhaps more sinister and serious problems, and gauge their responses accordingly.

• The location, status and activity of all enforcement resources.

• Communications and information sharing between response forces.

Response operations

The ability to promptly terminate a disruption, apprehend wrongdoers, restore the system, and help those impacted rapidly recover. This requires:

• Sufficient resources to effectively respond to and terminate disruptions This includes the ability to operate on the land, sea, and in the air. Also the capability and capacity to apprehend, process and sanction those involved.

• Sufficient resources to promptly recover the system from a disruption and restore services.

• Preparation, exercise and training for response personnel.

The structure of governance

This author is tempted to postulate that the actual organizational structure of PNT governance is irrelevant. As long as it ensures quality services, prevents and responds to disruptions, what does it matter how the shapes on an organization chart are arrayed?

Yet organization charts mean things. They describe roles and, more importantly, relationships. They greatly influence how, and if, things get done. This is important because governance cannot be a static, “one shot and you are done,” endeavor. It must be dynamic and adapt to changing environments and realities.

Attributes for Good Governance

So structure can be important. While it may take many forms, good PNT governance must be organized such that:

• The views of all users are regularly heard, understood and considered

• Authorities and responsibilities of all participants are clear.

• Policies and plans to ensure reliable PNT services are developed and implemented. These include:

– Prevention of service disruptions

– Response to service disruptions that include system restoration and recovery

– Ensuring the long term health and improvement of services

• One official is designated the primary leader for national PNT governance. The leader and his or her organization should have:

– Ensuring national PNT services as a part of their core missions

– The technical expertise and stature to be a credible leader

– The ability to act as the secretariat for PNT stakeholders and users

– The organizational status and budget authority to carry out their responsibilities.

The greatest return on investment – Five things every nation should do now

PNT has become supremely important. These services are a matter of national and economic security for every country. All should be more than eager to make every effort to ensure they are sufficient and reliable. Yet the long list of tasks for governments provided in this paper could seem overwhelming. Not all of the tasks and conditions are of equal importance, though. Implementation of a select few will enable any nation to realize great benefit from improved PNT governance and resilence.

1) Publicly recognize and designate PNT as critical infrastructure. PNT is critical infrastructure by almost any conceivable definition. Saying this out loud helps move it from being an unappreciated, silent utility and into the public consciousness. It will help garner support for governance efforts, and inspire innovation and contributions from unexpected quarters.

2) Appoint a principal leader for national PNT. Governance of services critical to a nation’s security, sovereignty, and economic wellbeing should be led by a prominent, respected official whose success or failure is tied to quality, resilient, uninterrupted services. PNT resilience should be part of the core missions of his or her organization. And, of course, this official should have the authority, status, and capability to carry out their responsibilities.

3) Criminalize manufacture, import, export, sale, ownership and use of jamming and spoofing devices. – Jamming and spoofing can lead to loss of life and extreme economic disruption. Monetary penalties do not have the same deterrent effect as the potential loss of personal liberty. Criminalizing these offenses is also a powerful public policy statement recognizing the importance of PNT, and the nation’s resolve to defend it.

4) Establish a network to detect PNT jamming and spoofing. – Just knowing the extent of the problem will help prevent more serious disruptions and foster innovative solutions. Ignorance is dangerous in any context, while transparency can energize stakeholders and lead to quickly correcting the behavior.

5) Ensure the availability of a national, difficult-to-disrupt, precise, wide area, wireless PNT source to be used alongside GNSS. Simply requiring owners and operators of critical infrastructure and critical applications to be able to continue operations for 60 days in the absence of GNSS is insufficient if they are unable to comply at a reasonable cost. PNT has become a common good, and governments must ensure that it is resilient. A second source of wireless PNT greatly increases national resilience by ensuring services to critical infrastructure and applications continue during GNSS disruptions. It also helps minimize the overall number of incidents by deterring those who would otherwise deliberately disrupt services.

End Note – PNT Governance within Commercial Organizations

The success or failure of many large and well capitalized commercial organizations is entirely dependent upon uninterrupted, precise PNT. While this paper has focused on the need for PNT governance at the national level, many companies should consider the question as well. For example, when I asked a senior leader at a global package delivery company for a contact to discuss PNT, he was quite taken aback. Their aviation division dealt with navigation issues. Their process control people were concerned with tagging, wirelessly tracking and time-stamping packages. The CFO dealt with electronic financial transactions, and, of course, the CIO’s office was involved with spectrum and IT issues. This major company’s lack of focus on PNT, not only failed to recognize PNT as a critical component of its success, and therefore a potential area of risk, but also prevented it from effectively engaging with the government on PNT resilience and governance issues.

The paper was presented in ENC-GNSS 2014, Rotterdam, Netherlands, 15-17 April.